ZeroDay Findings
Sign inSign up

Findings

CVE-2021-1497

Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

Published May 6, 2021 · updated Jun 16, 2026 · cisco hyperflex hx data platform

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Timeline

Detection, updates, and resolution for this record.

  1. May 6, 2021 · Catalog

    Detected

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Nov 17, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Required action

Apply updates per vendor instructions.

CISA due date Nov 17, 2021

Affected

  • cpe cisco/hyperflex hx data platformversion unspecified
  • vendor Cisco HyperFlex HXversion unspecified

Sources

  • CISA KEVCVE-2021-1497

    Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.

    cisa.gov
  • CVE.orgCVE-2021-1497

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-1497

    30-day exploitation probability 99.9%

    first.org
  • Metasploit Modulesexploit_linux/http/cisco_hyperflex_hx_data_platform_cmd_exec

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2021-1497

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References